6bb37d98e1
Changelog:
New
* Firefox now supports simultaneously watching multiple videos in
Picture-in-Picture.
* Today, Firefox introduces Total Cookie Protection to Strict Mode. In Total
Cookie Protection, every website gets its own "cookie jar," preventing
cookies from being used to track you from site to site.
* We've improved our Print functionality with a cleaner design and better
integration with your computer's printer settings.
* For Firefox users in Canada, credit card management and auto-fill are now
enabled.
* Notable performance and stability improvements are achieved by moving
canvas drawing and WebGL drawing to the GPU process.
Fixed
* Reader mode now works with local HTML pages.
* Using screen reader quick navigation to move to editable text controls no
longer incorrectly reaches non-editable cells in some grids such as on
messenger.com.
* The Orca screen reader's mouse review feature now works correctly after
switching tabs in Firefox.
* Screen readers no longer report column headers incorrectly in tables
containing cells spanning multiple columns.
* Links in Reader View now have more color contrast.
* Various security fixes.
Changed
* On Linux and Android, the protection to mitigate the stack clash attack has
been activated.
* From Firefox 86 onward, DTLS 1.0 is no longer supported for establishing
WebRTC's PeerConnections. All WebRTC services need to support DTLS 1.2 from
now on as the minimum version.
* Consolidated all video decoding in the new RDD process which results in a
more secure Firefox.
Enterprise
* Various bug fixes and new policies have been implemented in the latest
version of Firefox. You can see more details in the Firefox for Enterprise
86 Release Notes.
Developer
* Developer Information
* CSS image-set() function in CSS is now enabled, allowing for responsive
images in CSS.
* Inactive CSS tool is now showing a warning when margin or padding is set on
internal table elements.
Inactive CSS screenshot
* Developer Tools Toolbox is now showing a number of errors on the current
page. This is a quick way to surface information to a developer that
something is wrong with their page. Clicking on the red exclamation icon
navigates the user to the Console panel.
Develeoper tools: screenshot of number of errors
Security fixes:
#CVE-2021-23969: Content Security Policy violation report could have contained
the destination of a redirect
#CVE-2021-23970: Multithreaded WASM triggered assertions validating separation
of script domains
#CVE-2021-23968: Content Security Policy violation report could have contained
the destination of a redirect
#CVE-2021-23974: noscript elements could have led to an HTML Sanitizer bypass
#CVE-2021-23971: A website's Referrer-Policy could have been be overridden,
potentially resulting in the full URL being sent as a Referrer
#CVE-2021-23976: Local spoofing of web manifests for arbitrary pages in Firefox
for Android
#CVE-2021-23977: Malicious application could read sensitive data from Firefox
for Android's application directories
#CVE-2021-23972: HTTP Auth phishing warning was omitted when a redirect is
cached
#CVE-2021-23975: about:memory Measure function caused an incorrect pointer
operation
#CVE-2021-23973: MediaError message property could have leaked information
about cross-origin resources
#CVE-2021-23978: Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
#CVE-2021-23979: Memory safety bugs fixed in Firefox 86
38 lines
1.7 KiB
C++
38 lines
1.7 KiB
C++
$NetBSD: patch-js_src_jit_ProcessExecutableMemory.cpp,v 1.2 2021/02/23 17:02:04 ryoon Exp $
|
|
|
|
PaX MPROTECT safety for NetBSD.
|
|
|
|
--- js/src/jit/ProcessExecutableMemory.cpp.orig 2021-02-11 21:17:13.000000000 +0000
|
|
+++ js/src/jit/ProcessExecutableMemory.cpp
|
|
@@ -362,9 +362,16 @@ static void* ReserveProcessExecutableMem
|
|
// Note that randomAddr is just a hint: if the address is not available
|
|
// mmap will pick a different address.
|
|
void* randomAddr = ComputeRandomAllocationAddress();
|
|
+#ifdef PROT_MPROTECT
|
|
+ void* p = MozTaggedAnonymousMmap(randomAddr, bytes,
|
|
+ PROT_MPROTECT(PROT_EXEC | PROT_WRITE | PROT_READ),
|
|
+ MAP_PRIVATE | MAP_ANON, -1, 0,
|
|
+ "js-executable-memory");
|
|
+#else
|
|
void* p = MozTaggedAnonymousMmap(randomAddr, bytes, PROT_NONE,
|
|
MAP_NORESERVE | MAP_PRIVATE | MAP_ANON, -1,
|
|
0, "js-executable-memory");
|
|
+#endif
|
|
if (p == MAP_FAILED) {
|
|
return nullptr;
|
|
}
|
|
@@ -409,8 +416,12 @@ static unsigned ProtectionSettingToFlags
|
|
|
|
[[nodiscard]] static bool CommitPages(void* addr, size_t bytes,
|
|
ProtectionSetting protection) {
|
|
- void* p = MozTaggedAnonymousMmap(
|
|
- addr, bytes, ProtectionSettingToFlags(protection),
|
|
+ void* p = MozTaggedAnonymousMmap(addr, bytes,
|
|
+#ifdef PROT_MPROTECT
|
|
+ ProtectionSettingToFlags(protection) | PROT_MPROTECT(PROT_EXEC | PROT_WRITE | PROT_READ),
|
|
+#else
|
|
+ ProtectionSettingToFlags(protection),
|
|
+#endif
|
|
MAP_FIXED | MAP_PRIVATE | MAP_ANON, -1, 0, "js-executable-memory");
|
|
if (p == MAP_FAILED) {
|
|
return false;
|